Abstract
We describe the on-going work towards further automating the analysis of data generated by a large honeynet architecture called Leurre.com and SGNET. The underlying motivation is helping us to integrate the use of honeypot data into daily network security monitoring. We propose a system a based oil two automated steps: i) the detection of relevant attack events within a, large honeynet traffic data set, and ii) the extraction of highly similar events based oil temporal correlation.